diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-28.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-28.xml new file mode 100644 index 0000000000..1324e48c39 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-28.xml @@ -0,0 +1,49 @@ + + + + Jython: Arbitrary code execution + A vulnerability in Jython may lead to arbitrary code execution. + + Jython + 2017-10-29 + 2017-10-29: 1 + 621876 + remote + + + 2.7.0-r2 + 2.7.0-r2 + + + +

An implementation of Python written in Java.

+
+ +

It was found that Jython is vulnerable to arbitrary code execution by + sending a serialized function to the deserializer. +

+
+ +

Remote execution of arbitrary code by enticing a user to execute + malicious code. +

+
+ +

There is no known workaround at this time.

+
+ +

All Jython users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-java/jython-2.7.0-r2" + +
+ + + CVE-2016-4000 + + + jmbailey + jmbailey +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-29.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-29.xml new file mode 100644 index 0000000000..a2dfda779e --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-29.xml @@ -0,0 +1,58 @@ + + + + Asterisk: Multiple vulnerabilities + Multiple vulnerabilities have been found in Asterisk, the worst of + which allows remote execution of arbitrary shell commands. + + asterisk + 2017-10-29 + 2017-10-29: 1 + 629682 + 629692 + 633856 + remote + + + 11.25.3 + 11.25.3 + + + +

A Modular Open Source PBX System.

+
+ +

Multiple vulnerabilities have been discovered in Asterisk. Please review + the referenced CVE identifiers for details. +

+
+ +

A remote attacker could execute arbitrary code, cause a denial of + service condition, or cause an unauthorized data disclosure by enticing a + user to run malicious code. +

+
+ +

There is no known workaround at this time.

+
+ +

All Asterisk users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-misc/asterisk-13.17.2" + +
+ + CVE-2017-14098 + + CVE-2017-14099 + + + CVE-2017-14100 + + CVE-2017-14603 + + jmbailey + jmbailey +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-30.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-30.xml new file mode 100644 index 0000000000..67af29cd0f --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-30.xml @@ -0,0 +1,63 @@ + + + + X.Org Server: Multiple vulnerabilities + Multiple vulnerabilities have been found in X.Org Server the worst + of which could allow a local attacker to replace shared memory segments. + + X.Org Server + 2017-10-29 + 2017-10-29: 1 + 493294 + 611350 + 633910 + local + + + 1.19.4 + 1.19.4 + + + +

The X.Org project provides an open source implementation of the X Window + System. +

+
+ +

Multiple vulnerabilities have been discovered in X.Org Server. Please + review the referenced CVE identifiers for details. +

+
+ +

A local attacker could cause a global buffer overflow or a Denial of + Service condition. +

+
+ +

There is no known workaround at this time

+
+ +

All X.Org Server users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.19.4" + +
+ + + CVE-2013-6424 + + + CVE-2017-13721 + + + CVE-2017-13723 + + + CVE-2017-2624 + + + jmbailey + jmbailey +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-31.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-31.xml new file mode 100644 index 0000000000..b6e438df40 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-31.xml @@ -0,0 +1,114 @@ + + + + Oracle JDK/JRE: Multiple vulnerabilities + Multiple vulnerabilities have been found in Oracle's JDK and JRE + software suites, the worst of which can be remotely exploited without + authentication. + + oracle,jdk,jre + 2017-10-29 + 2017-10-29: 1 + 635030 + remote + + + 1.8.0.152-r1 + 1.8.0.152-r1 + + + 1.8.0.152-r1 + 1.8.0.152-r1 + + + +

Java Platform, Standard Edition (Java SE) lets you develop and deploy + Java applications on desktops and servers, as well as in today’s + demanding embedded environments. Java offers the rich user interface, + performance, versatility, portability, and security that today’s + applications require. +

+
+ +

Multiple vulnerabilities have been discovered in Oracle’s Java SE. + Please review the referenced CVE identifiers for details. +

+
+ +

A remote attacker could cause a Denial of Service condition, modify + arbitrary data, or have numerous other impacts. +

+
+ +

There is no known workaround at this time.

+
+ +

All Oracle JDK users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-java/oracle-jdk-bin-1.8.0.152-r1" + + +

All Oracle JRE users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose + ">=dev-java/oracle-jre-bin-1.8.0.152-r1" + +
+ + + CVE-2017-10274 + + + CVE-2017-10281 + + + CVE-2017-10285 + + + CVE-2017-10293 + + + CVE-2017-10295 + + + CVE-2017-10309 + + + CVE-2017-10345 + + + CVE-2017-10346 + + + CVE-2017-10347 + + + CVE-2017-10348 + + + CVE-2017-10349 + + + CVE-2017-10350 + + + CVE-2017-10355 + + + CVE-2017-10356 + + + CVE-2017-10357 + + + CVE-2017-10388 + + + jmbailey + jmbailey +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-32.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-32.xml new file mode 100644 index 0000000000..61324a61d4 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201710-32.xml @@ -0,0 +1,77 @@ + + + + Apache: Multiple vulnerabilities + Multiple vulnerabilities have been found in Apache, the worst of + which may result in the loss of secrets. + + Apache + 2017-10-29 + 2017-10-29: 1 + 622240 + 624868 + 631308 + remote + + + 2.4.27-r1 + 2.4.27-r1 + + + +

The Apache HTTP server is one of the most popular web servers on the + Internet. +

+
+ +

Multiple vulnerabilities have been discovered in Apache. Please review + the referenced CVE identifiers for details. +

+
+ +

The Optionsbleed vulnerability can leak arbitrary memory from the server + process that may contain secrets. Additionally attackers may cause a + Denial of Service condition, bypass authentication, or cause information + loss. +

+
+ +

There is no known workaround at this time.

+
+ +

All Apache users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=www-servers/apache-2.4.27-r1" + +
+ + + CVE-2017-3167 + + + CVE-2017-3169 + + + CVE-2017-7659 + + + CVE-2017-7668 + + + CVE-2017-7679 + + + CVE-2017-9788 + + + CVE-2017-9789 + + + CVE-2017-9798 + + + jmbailey + jmbailey +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201711-01.xml b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201711-01.xml new file mode 100644 index 0000000000..7ca8635c85 --- /dev/null +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201711-01.xml @@ -0,0 +1,82 @@ + + + + libxml2: Multiple vulnerabilities + Multiple vulnerabilities have been found in libxml2, the worst of + which could result in the execution of arbitrary code. + + libxml2 + 2017-11-10 + 2017-11-10: 2 + 599192 + 605208 + 618604 + 622914 + 623206 + remote + + + 2.9.4-r3 + 2.9.4-r3 + + + +

libxml2 is the XML (eXtended Markup Language) C parser and toolkit + initially developed for the Gnome project. +

+
+ +

Multiple vulnerabilities have been discovered in libxml2. Please review + the CVE identifiers referenced below for details. +

+
+ +

A remote attacker, by enticing a user to process a specially crafted XML + document, could remotely execute arbitrary code, conduct XML External + Entity (XXE) attacks, or cause a Denial of Service condition. +

+
+ +

There is no known workaround at this time.

+
+ +

All libxml2 users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.9.4-r3" + + +

Packages which depend on this library may need to be recompiled. Tools + such as revdep-rebuild may assist in identifying some of these packages. +

+
+ + + CVE-2016-9318 + + + CVE-2017-0663 + + + CVE-2017-5969 + + + CVE-2017-7375 + + + CVE-2017-9047 + + + CVE-2017-9048 + + + CVE-2017-9049 + + + CVE-2017-9050 + + + chrisadr + b-man +
diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk index 6b302d3bf2..c83fab9a10 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk @@ -1 +1 @@ -Mon, 23 Oct 2017 17:39:28 +0000 +Fri, 10 Nov 2017 14:38:58 +0000 diff --git a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit index 350c70c794..348e97cba8 100644 --- a/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit +++ b/sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit @@ -1 +1 @@ -3c64211d24fa5a633310d841c0bd5cddc991cc02 1508723227 2017-10-23T01:47:07+00:00 +4ad72e046fa706e5fe66f5299894eb730f6b5bba 1510281582 2017-11-10T02:39:42+00:00